Digital Design / Module 10: Clock domain crossing
53. Metastability and MTBF
Understand why synchronizers exist.
See it move
The idea
A flop is built around a feedback loop with two stable states. If data changes right at the clock edge, breaking setup or hold, the loop can land near its balance point, like a ball on the top of a hill. It will roll to one side eventually, but nobody can say how long this takes. This state is called metastability.
Why you can't avoid it
When clocks are unrelated, the data will sometimes change near the edge. No design can prevent that. What you can do is give the flop time to settle before anyone uses its output, and make failure extremely unlikely.
The odds
The chance of still being unresolved falls exponentially with waiting time:
MTBF = e^(t / τ) / (T0 · fclk · fdata)
tis the settling time available.τis a flop characteristic: smaller means faster resolution.T0relates to how wide the vulnerable window is.fclkandfdataset how often an edge may catch a change.
The exponential is what matters. A little more settling time gives an enormous improvement. A flop adds almost a whole clock period of settling time, which can raise MTBF by many orders of magnitude.
The synchronizer
Two flops in series give the first one a full cycle to settle before the second one samples it. Even if the first flop is unresolved, it has almost always settled by the next edge. The second output is then a clean 0 or 1, either the old value or the new.
Common mistake
Saying that a synchronizer eliminates metastability. It makes failure very rare but not impossible, so you design for an acceptable MTBF. Remember the whole product: 10 years of MTBF for one synchronizer means something different in a chip with a million units, each with hundreds of synchronizers. High-frequency or safety-critical designs use three stages. Drag the sliders above, and watch how strongly MTBF depends on the settling time.
Key ideas
- An async change near the edge can leave a flop between 0 and 1.
- It settles eventually; the odds fall exponentially with time.
- MTBF rises dramatically with each added synchronizer stage's settling time.
Lab: Clock crossing lab
Your exercise
Interview questions
coreDoes a 2-flop synchronizer remove metastability?
No, it makes failure very unlikely; the MTBF is what you design for.
basicWhat is metastability, and why can no design prevent it when two clocks are unrelated?
A flop holds its value in a feedback loop with two stable states. If the data changes inside the setup and hold window, the loop can be left near its balance point, neither 0 nor 1, and it takes an unpredictable time to fall to one side. With unrelated clocks, the data changes at every possible point relative to the sampling edge over time, so some changes will land in that window. You cannot stop that happening; you can only give the flop enough time to settle before anyone uses its output.
basicIn MTBF = e^(t / tau) / (T0 x fclk x fdata), which term gives a designer the most control, and why?
The settling time t, because it sits in the exponent. Halving fclk or fdata only changes MTBF by a factor of two, but adding a small amount of settling time multiplies MTBF by a huge factor. That is why adding a synchronizer stage, which adds almost a whole clock period of settling time, is so effective. tau and T0 belong to the flop itself, so you only choose them by choosing the cell.
coreA flop has tau = 0.05 ns. How much extra settling time makes MTBF ten times larger? How much for a thousand times?
MTBF grows as e^(t / tau), so a factor of 10 needs t / tau to grow by ln 10, about 2.303. That is 0.05 x 2.303 = 0.115 ns of extra settling time. A factor of 1000 is three of those steps, about 0.345 ns. A fraction of a nanosecond buys orders of magnitude, which is why settling time is so valuable.
coreWith tau = 0.05 ns, T0 = 0.1 ns, fclk = 500 MHz, fdata = 10 MHz and 1.8 ns of settling time, MTBF is about 273 years. What is it if the data only changes at 1 MHz?
fdata appears once in the denominator, so cutting it by 10 raises MTBF by exactly 10, to about 2,730 years. To check the base number: the denominator is 0.1 ns x 500 MHz x 10 MHz = 5 x 10^5 per second, and e^(1.8 / 0.05) = e^36, about 4.3 x 10^15. Dividing gives about 8.6 x 10^9 seconds, which is 273 years. The rate terms are linear, unlike the settling time.
coreOne synchronizer has an MTBF of 1 million years. A product ships 10,000 units, each with 50 such synchronizers. What is the expected time between failures across the whole fleet?
Failures from independent synchronizers add up, so the fleet sees 10,000 x 50 = 500,000 times as many. 1,000,000 years / 500,000 = 2 years. So somewhere in the field, a synchronizer fails about every two years, even though each one looks extremely safe. The MTBF target has to be set for the whole product, not for one flop.
coreYour RTL and gate-level simulations of a clock crossing never show an X at the synchronizer. Does that show the design is safe from metastability?
No. A logic simulator only has 0, 1, X and Z, and a typical flop model picks a clean value, so it cannot represent a flop hovering between 0 and 1 or settling late. Safety comes from structure and numbers: a proper synchronizer, enough settling time for the target MTBF, and CDC checks. Simulation shows functional behaviour around the crossing, not whether the flop resolves in time.
advancedUsing the same constants (tau 0.05 ns, T0 0.1 ns, fdata 10 MHz, 0.2 ns of each period used by the flops), a two-flop synchronizer at 500 MHz has an MTBF of about 273 years. What happens at 1 GHz, and why is the drop so large?
At 1 GHz the period is 1.0 ns, so settling time falls from 1.8 to 0.8 ns. The exponent drops from 36 to 16, which is a factor of e^20, about 4.9 x 10^8, and the doubled fclk costs another factor of 2. MTBF becomes e^16 / (0.1 ns x 1 GHz x 10 MHz) = 8.9 x 10^6 / 10^6, about 9 seconds. Doubling the clock made failures about a billion times more frequent, so fast clocks often need a third stage.
advancedWhen would you choose a three-flop synchronizer over two, and what does it cost?
A third flop adds almost another full period of settling time, so with the constants above at 500 MHz the settling time goes from 1.8 to 3.6 ns and MTBF from about 273 years to about 10^18 years. You choose it when the clock is fast, when there are many synchronizers in many units, or when the product is safety-critical and the two-stage MTBF is not enough. The cost is one more cycle of latency and one more flop per crossing. You decide by computing MTBF against a target, not by habit.